DDoS protection works great until threat actors find a way around it. Never 100% effective, it’s why they still happen. Really, I’d say they either need to hire an outside firm or quickly assemble a cyber forensics team. Whoever is flooding their server is undoubtedly doing it in a way they can’t effectively respond to.